Potential Goofy Guineapig GoogleUpdate Process Anomaly
Detects "GoogleUpdate.exe" spawning a new instance of itself in an uncommon location, a technique used by the Goofy Guineapig backdoor to evade detection. The rule specifically looks for instances where both the parent and child process images are named 'GoogleUpdate.exe', but the child process is not located in standard Google installation or update paths.
Sigma
